dsh-self-evolve
Agent-authored procedural memory for DeepSeek Harness.
The agent saves a proven procedure as a SKILL.md in a root the harness already
scans, and future sessions follow it instead of rediscovering it — with the
guards, budgets and approvals an unattended self-improvement loop needs.
This is a fork of jianghuife/dsh-self-evolve
(MIT), ported to DSH 0.2.1-rc.2 and extended. The upstream proof of concept was
a single 0.1.0 release; this fork keeps its small core and adds the missing
safety rails plus the automatic half of the loop.
Status: 0.4.0, 106 tests, typechecked against DSH 0.2.1-rc.2. Not published
to npm; install from GitHub or a local checkout.
What it does
| Capability | Details |
|---|
skill_manage tool | list, create, patch, edit, delete (archives), write_file, remove_file, pin, unpin |
| User + project scope | ~/.dsh/skills and <project>/.dsh/skills, plus flat <name>.md skills |
| Read before write | a skill must be loaded with the skill tool before it can be patched, edited, deleted or pinned |
| Duplicate refusal | create rejects near-duplicates and names the skill to patch instead |
| Credential + lint scan | blocks credential-shaped text; warns on oversized bodies, incident-log shape, references sprawl, destructive shell idioms |
| Staged approvals | optional writeApproval; review diffs with /skills pending, settle with approve/reject |
| Post-turn reviewer | opt-in fork of the finished turn that patches or creates skills, isolated from the main transcript |
| Jev gate | optional TypeSafe Jev call that can cancel a pointless review, with deterministic fallback |
| Curator | mechanical aging: stale after 30 days, archived after 90, pinned skills exempt, only agent-authored skills, never hard-deleted |
| Usage ledger | records loads and review-gate decisions for tuning |
Requirements
- DeepSeek Harness
0.2.1-rc.2 (the tested target; other 0.2.x may work).
- Node.js 22.19 or newer.
- Optional: a TypeSafe API key (
TYPESAFE_API_KEY) only if you enable the Jev gate.
Install
From GitHub (once the repository is published):
dsh plugin --profile web add github:Kosello/dsh-self-evolve
From a local checkout:
git clone https://github.com/Kosello/dsh-self-evolve.git
cd dsh-self-evolve
npm ci
npm run build # produces dist/ (also committed for GitHub installs)
dsh plugin --profile web add "$PWD"
Then restart the profile. The plugin activates as the self-evolve row and adds
skill_manage together with the /skills command. See
docs/installation.md for manual wiring, environment
files, verification and uninstall.
Configure
Everything is optional; defaults keep the plugin useful and quiet. Put overrides
on the row in your profile's cordis.patch.yml:
- id: self-evolve
config:
readBeforeWrite: true # default
writeApproval: false # set true to review every write
review:
enabled: true # the reviewer spends tokens; opt in
turnInterval: 10
toolCallThreshold: 15
gate: jev # counters (default) or jev
jev:
model: jev-latest
apiKeyEnv: TYPESAFE_API_KEY
confidentNo: 0.75
The full key reference, including the reviewer and gate budgets, is in
docs/configuration.md.
Enabling the Jev gate
The gate is off unless you ask for it, and it degrades to counters when it
cannot run. Give the harness the key through a dedicated env file rather than
the profile YAML:
install -m 600 /dev/null ~/.dsh/typesafe.env
printf 'TYPESAFE_API_KEY=%s\n' "$YOUR_KEY" >> ~/.dsh/typesafe.env
mkdir -p ~/.config/systemd/user/deepseek-harness.service.d
printf '[Service]\nEnvironmentFile=%%h/.dsh/typesafe.env\n' \
> ~/.config/systemd/user/deepseek-harness.service.d/typesafe.conf
systemctl --user daemon-reload
systemctl --user restart deepseek-harness.service
Use
The model gets one new tool:
| Action | Purpose |
|---|
list | skills across both scopes, with uses and layout |
create | new skill; scope: "user" | "project" |
patch | exact-text replace inside SKILL.md (preferred update) |
edit | replace body/description wholesale |
delete | archive (never hard-delete) |
write_file / remove_file | supporting files under the skill directory |
pin / unpin | exempt a skill from curator aging |
Humans get the /skills command:
/skills pending | diff <id> | approve <id|all> | reject <id|all>
/skills approval on|off
/skills review on|off|now
Worked examples are in docs/usage.md.
How the loop fits together
turn ends ──▶ counters due? ──▶ (optional) Jev gate ──▶ fork reviewer
│
skill_manage ─┴─▶ ~/.dsh/skills/<name>/SKILL.md
│
next session ─┴─▶ skill catalog (progressive disclosure)
The reviewer and gate are described in docs/review-loop.md;
the module map is in docs/architecture.md.
Safety model
- No secrets in the repository. API keys are read from the process
environment; the profile YAML holds names, never values.
- The gate is advisory. It can only cancel a review it is confident is
pointless; permissions, approvals and write guards stay deterministic.
- The reviewer writes through
skill_manage, so read-before-write,
duplicate refusal, credential scanning and staged approval all still apply.
- The review child inherits the parent toolset, but its scope is narrowed to
skill + skill_manage right after activation; DSH has no per-activation
tool filter, so this is defence in depth, not a sandbox. Run with
writeApproval: true when reviewing untrusted conversations.
- Outbound data: only the Jev gate sends anything off-machine — a bounded
digest (user message, assistant message, tool count, loaded skill names, turn
index), never tool output.
Details and threat model: docs/security.md.
Development
npm ci
npm run check # tsc against DSH 0.2.1-rc.2
npm test # 106 unit/integration tests
npm run build # dist/index.js
npm run smoke # built tool → real dsh-skill + dsh-skill-filesystem catalog
npm run gate-stats # summarize ~/.dsh/self-evolve/gates.jsonl
npm run verify # check + test + build + smoke
CI runs the same checks on every push (.github/workflows/ci.yml).
Compatibility and known limits
- Built and tested against DSH
0.2.1-rc.2; the plugin API is young and may move.
- The reviewer needs the
subagent service and a provider (fork by default).
- Tool narrowing for the review child is post-hoc; see the security doc.
- Review children run on the parent's model, so the reviewer is the expensive
part of the loop. Counters, cooldown and per-session caps bound it.
- No memory store: durable facts belong to whatever memory layer your profile
composes (for example an MCP memory server), not to this plugin.
License and attribution
MIT. The upstream copyright notice is retained in LICENSE; this
fork's changes are offered under the same terms. Upstream:
jianghuife/dsh-self-evolve.
